diff --git a/tools/git-if-needed/python/gifn_apply/gifn.py b/tools/git-if-needed/python/gifn_apply/gifn.py
index 3e313a8..b17cd76 100644
--- a/tools/git-if-needed/python/gifn_apply/gifn.py
+++ b/tools/git-if-needed/python/gifn_apply/gifn.py
@@ -21,6 +21,6 @@
     cmdstr = shlex.join(str(arg) for arg in cmd)
     cfg.log.debug("Running `%(cmdstr)s`", {"cmdstr": cmdstr})
     try:
-        subprocess.run(cmd, check=True, cwd=tempd, shell=False)
+        subprocess.run(cmd, check=True, cwd=tempd, shell=False)  # noqa: S603
     except (OSError, subprocess.CalledProcessError) as err:
         raise defs.GApplyError(f"Could not run `{cmdstr}` in {tempd}: {err}") from err
diff --git a/tools/git-if-needed/python/gifn_apply/git.py b/tools/git-if-needed/python/gifn_apply/git.py
index 038d167..f19efab 100644
--- a/tools/git-if-needed/python/gifn_apply/git.py
+++ b/tools/git-if-needed/python/gifn_apply/git.py
@@ -44,7 +44,7 @@
     )
     try:
         subprocess.run(
-            ["git", "clone", repo_url.geturl(), repo.repo, "-b", "master"],
+            ["git", "clone", repo_url.geturl(), repo.repo, "-b", "master"],  # noqa: S603,S607
             check=True,
             cwd=repo_dir.parent,
         )
@@ -65,10 +65,10 @@
         lines = [
             line
             for line in subprocess.check_output(
-                ["git", "log", "--pretty=%(trailers:key=Change-Id)", "--reverse"],
+                ["git", "log", "--pretty=%(trailers:key=Change-Id)", "--reverse"],  # noqa: S607
                 cwd=repo_dir,
                 encoding="UTF-8",
-                shell=False,
+                shell=False,  # noqa: S603
             ).splitlines()
             if line
         ]